chore: readme 수정

.work/keycloak-four-patterns/final/assets/ap2-mediator-handoff-flow/ap2-mediator-handoff-flow.d2

@@ -0,0 +1,21 @@
+# AP2 server-held token에서 브라우저 Bearer 요청까지
+# Question: AP2에서 AP2_SESSION으로 찾은 server-side authorized client는 어떻게 브라우저의 직접 Bearer API 호출이 되는가?
+direction: right
+n0: "브라우저" {
+  shape: rectangle
+}
+n1: "Spring mediator" {
+  shape: rectangle
+}
+n2: "Authorized-client store" {
+  shape: rectangle
+}
+n3: "Resource Server" {
+  shape: rectangle
+}
+n0 -> n1: "GET /token/access + AP2_SESSION"
+n1 -> n2: "authorize current principal"
+n2 -> n1: "current access token"
+n1 -> n0: "access token + type + expiry"
+n0 -> n3: "GET /api/me · browser-created Bearer"
+n3 -> n0: "subject · username · issuer · audience"